Privacy Policy

This policy applies to all users of Prudora — including students under 18 and their parents or guardians. Prudora is a personalised study coach for IB Mathematics. We take the privacy of young people especially seriously and have designed our data practices accordingly.

We do not collect sensitive categories of data (Art. 9 GDPR), payment card details, or any location data. We do not use your data for advertising or sell it to third parties.

Prudora is designed for students aged 16–18 preparing for IB examinations. The current beta is open only to students aged 16 or over. Before onboarding, each student must confirm that they meet that age requirement and accept this policy.

• Age 16 and over: you can agree to this policy yourself during onboarding. We record the time of your age confirmation and consent.
• Under 16: please do not complete registration for this beta. We do not currently use a student's own tick-box as evidence of parental consent.

Before Prudora is opened to under-16s, we will put an appropriate parent or guardian consent process in place and update this policy. A parent or guardian may contact us at any time with a privacy question or request.

When you use the Artificial Intelligence tutor feature, your messages and the question context are sent to Anthropic, Inc. (USA) for processing. Anthropic does not use your data to train their models by default. See Anthropic's privacy policy. A Data Processing Agreement (DPA) is in place between Prudora and Anthropic.

Retention: Artificial Intelligence tutor conversation history is automatically deleted after 90 days.

We use the following sub-processors, each bound by a DPA:

SCCs = EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), used where processors are based outside the EEA.

• Account and practice data: kept for as long as your account is active. Deleted immediately and permanently when you delete your account.
• Artificial Intelligence tutor conversations: automatically deleted after 90 days from the last message.
• Email logs (Resend): retained for up to 30 days by Resend for delivery debugging.
• Consent record: kept for 5 years after account deletion, as required for legal accountability under Art. 7(1) GDPR.

Under GDPR you have the right to:

• Access (Art. 15): download everything we hold about you. Profile → Export my data.
• Rectification (Art. 16): correct your name, grade target or exam date from Profile settings.
• Erasure (Art. 17): permanently delete your account and all associated data. Profile → Delete my account.
• Restriction (Art. 18) / Objection (Art. 21): contact us directly at info@irinaoliveira.com.
• Portability (Art. 20): the data export is machine-readable JSON covering all tables.
• Complaint: you have the right to lodge a complaint with your national supervisory authority. In Portugal: CNPD (cnpd.pt).

We will respond to all rights requests within 30 days (Art. 12(3) GDPR).

Data is encrypted in transit (TLS 1.2+) and at rest. Access to the database is restricted to authenticated users via Row Level Security (RLS) policies — your data is only accessible to you and your assigned teacher. We apply Content-Security-Policy, HSTS, and other defence-in-depth headers.

To report a security vulnerability: security.txt.

Prudora uses a single session cookie set by Supabase Auth (name: sb-<project>-auth-token). This is a strictly necessary cookie — it is required for you to be logged in. We do not use advertising or analytics cookies. A small amount of data (haptic feedback preference, theme) is stored in localStorage on your device and never transmitted to our servers.

We will notify you of material changes by email or via an in-app banner at least 14 days before the change takes effect. The “Last updated” date at the top of this page shows when it was last revised.

For any privacy question, rights request, or concern: info@irinaoliveira.com. We aim to respond within 3 business days.